@metamynd/agentsafe-signer 0.14.0 → 0.15.3

package/README.md

@@ -28,7 +28,7 @@ tells you what to set. Opens the signing socket (always on) and the admin socket
 ## Status
 
 **Implemented and tested:**
-- The full eight-operation signing-socket protocol (`sign-authorize`, `sign-envelope`,
+- The full nine-operation signing-socket protocol (`sign-authorize`, `sign-envelope`, `sign-payload`,
   `sign-handshake-nonce`, `sign-key-control-challenge`, `sign-log-checkpoint`,
   `sign-local-decision`, `get-identity`, `ping`) and the two-operation admin socket
   (`generate-key`, `status`), matching the design doc's closed operation set exactly — no generic
@@ -146,6 +146,15 @@ tells you what to set. Opens the signing socket (always on) and the admin socket
   same as `sign-authorize`/`sign-envelope` (a service-role daemon never evaluates a mandate
   locally). `daemon-protocol.smoke.mjs`, `daemon-envelope-parity.smoke.mjs`.
 
+- **`sign-payload` (0.15.0) — payload binding without giving up custody.** An agent-role daemon signs the
+  digest of the COMPLETE payload an agent will execute (MAGP 8.3.9), and — when given an `authorizationId` — the
+  late binding of a hold that already exists (8.3.11, a reviewer's MODIFY mints one with no digest). Like every op
+  here it builds the message itself from validated fields and never signs caller-supplied bytes: the digest must be
+  `sha256:` + 64 lower-case hex, the authorization id a UUID, and the message starts with a domain prefix
+  (`MAGP-PAYLOAD-v1` / `MAGP-PAYLOAD-REBIND-v1`) that nothing else this daemon signs starts with, so the signature
+  cannot be replayed as an authorize, envelope, handshake or challenge. Before this a daemon-backed guard asked to
+  bind a payload failed closed. `daemon-protocol.smoke.mjs`.
+
 **Deliberately not yet implemented — real gaps, not oversights:**
 - **The generated systemd unit has never started a daemon.** Running it for real on Ubuntu 24.04
   LTS / systemd 255 (the first time this was tried on any Linux host) found five defects in a

package/daemon.mjs

@@ -8,6 +8,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { buildAuthMessage, buildCheckpointAnchorMessage, buildLocalDecisionMessage } from './policy-core.mjs';
 import { envelopeHashFor } from './governance-envelope.mjs';
+import { buildPayloadBindingMessage, buildPayloadRebindMessage, isPayloadDigest } from './payload-binding.mjs';
 import { KeyStore, KeyStoreError } from './keystore.mjs';
 import { createSecurePipePool, createSecurePipeOnce } from './windows-secure-pipe.mjs';
 import { takeCheckpoint } from './log-checkpoint.mjs';
@@ -17,7 +18,7 @@ export const MAX_LINE_BYTES = 64 * 1024;
 export const FRESHNESS_MS = 5 * 60 * 1000;
 export const CLOCK_SKEW_MS = 30 * 1000;
 
-const ALL_SIGNING_OPS = new Set(['sign-authorize', 'sign-envelope', 'sign-handshake-nonce', 'sign-key-control-challenge', 'sign-log-checkpoint', 'sign-local-decision', 'get-identity', 'ping']);
+const ALL_SIGNING_OPS = new Set(['sign-authorize', 'sign-envelope', 'sign-payload', 'sign-handshake-nonce', 'sign-key-control-challenge', 'sign-log-checkpoint', 'sign-local-decision', 'get-identity', 'ping']);
 
 // sign-log-checkpoint is in BOTH role sets, unlike every other sign-* op: it authenticates the
 // daemon's own log-tamper-evidence checkpoint (T11), which every daemon keeps regardless of
@@ -27,13 +28,15 @@ const ALL_SIGNING_OPS = new Set(['sign-authorize', 'sign-envelope', 'sign-handsh
 // (agentsafe-guard.mjs's reportLocalDecision()); a service-role daemon never evaluates a
 // mandate locally, so it has nothing to report.
 const SIGNING_OPS_BY_ROLE = {
-  agent: new Set(['sign-authorize', 'sign-envelope', 'sign-handshake-nonce', 'sign-key-control-challenge', 'sign-log-checkpoint', 'sign-local-decision', 'get-identity', 'ping']),
+  agent: new Set(['sign-authorize', 'sign-envelope', 'sign-payload', 'sign-handshake-nonce', 'sign-key-control-challenge', 'sign-log-checkpoint', 'sign-local-decision', 'get-identity', 'ping']),
   service: new Set(['sign-handshake-nonce', 'sign-log-checkpoint', 'get-identity', 'ping']),
 };
 
 const DEFAULT_RATE_LIMITS = {
   'sign-authorize': { max: 20, windowMs: 10_000 },
   'sign-envelope': { max: 20, windowMs: 10_000 },
+  // One per bound authorize, plus one per late binding (a modified hold): never more than sign-authorize itself.
+  'sign-payload': { max: 20, windowMs: 10_000 },
   'sign-handshake-nonce': { max: 10, windowMs: 60_000 },
   'sign-key-control-challenge': { max: 3, windowMs: 60 * 60 * 1000 },
   // Local decisions are reported for every locally-decided block/escalate/non-value-allow, not
@@ -238,6 +241,8 @@ export class SignerDaemon {
         return this.#handleSignAuthorize(params);
       case 'sign-envelope':
         return this.#handleSignEnvelope(params);
+      case 'sign-payload':
+        return this.#handleSignPayload(params);
       case 'sign-handshake-nonce':
         return this.#handleSignHandshakeNonce(params);
       case 'sign-key-control-challenge':
@@ -309,6 +314,37 @@ export class SignerDaemon {
     return { signature: this.#sign(Buffer.from(message, 'utf8')) };
   }
 
+  /**
+   * Payload binding (MAGP 8.3.9 / 8.3.11): signs the digest of the COMPLETE payload an agent will execute, bound to ONE
+   * authorization. Like every other op here the daemon builds the message ITSELF from structured, validated fields; it never
+   * signs bytes a caller hands it. The digest is checked to be `sha256:` + 64 lower-case hex, so the only free-form thing in the
+   * message is a fixed-shape hash under a fixed domain prefix (MAGP-PAYLOAD-v1 / MAGP-PAYLOAD-REBIND-v1) that no other message
+   * this daemon signs starts with — a signature made here cannot be replayed as an authorize, envelope, handshake or challenge.
+   *
+   * Without `authorizationId` it signs the authorize-time binding (named by the request's own nonce and issuedAt). With one it
+   * signs the LATE binding for a hold that already exists (a reviewer's MODIFY mints one with no digest), which names that
+   * authorization so the digest cannot be lifted onto another. The id must be a UUID, which is what the issuer mints.
+   */
+  #handleSignPayload(params = {}) {
+    this.#assertRateLimit('sign-payload');
+    const { agentDid, action, nonce, issuedAt, payloadDigest, authorizationId } = params;
+    if (typeof agentDid !== 'string' || typeof action !== 'string' || typeof nonce !== 'string' || typeof issuedAt !== 'string') {
+      throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'missing required field');
+    }
+    if (action.length === 0 || action.includes('|')) throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'invalid action');
+    if (nonce.length === 0 || nonce.length > 128) throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'invalid nonce');
+    if (!isPayloadDigest(payloadDigest)) throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'payloadDigest must be sha256: followed by 64 lower-case hex');
+    if (authorizationId !== undefined && (typeof authorizationId !== 'string' || !UUID_RE.test(authorizationId))) {
+      throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'authorizationId must be a UUID');
+    }
+    this.#assertIdentity(agentDid);
+    if (!freshnessOk(issuedAt)) throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'issuedAt outside freshness window');
+    const message = authorizationId === undefined
+      ? buildPayloadBindingMessage({ agentDid, action, nonce, issuedAt, payloadDigest })
+      : buildPayloadRebindMessage({ agentDid, action, authorizationId, nonce, issuedAt, payloadDigest });
+    return { signature: this.#sign(Buffer.from(message, 'utf8')) };
+  }
+
   #handleSignEnvelope(params = {}) {
     this.#assertRateLimit('sign-envelope');
     this.#validateCoreFields(params);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-signer",
-  "version": "0.14.0",
+  "version": "0.15.3",
   "description": "Local signer daemon for AgentSafe agent/service keys \u2014 the key never enters the calling guard's own process. See docs/design/agent-key-custody-local-signer-daemon-plan.md.",
   "type": "module",
   "main": "./daemon.mjs",
@@ -24,6 +24,7 @@
     "cli.mjs",
     "policy-core.mjs",
     "governance-envelope.mjs",
+    "payload-binding.mjs",
     "README.md",
     "LICENSE"
   ],

package/payload-binding.mjs

@@ -0,0 +1,121 @@
+// GENERATED from backend/src/features/magp/payload-binding.ts - do not edit. Regenerate: npm run build:signer-core
+
+// src/features/magp/payload-binding.ts
+import { createHash } from "node:crypto";
+
+// src/policy-core/canonical.ts
+function escapeField(v) {
+  return v.replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
+}
+
+// src/features/magp/payload-binding.ts
+var PAYLOAD_BINDING_PREFIX = "MAGP-PAYLOAD-v1";
+var PAYLOAD_REBIND_PREFIX = "MAGP-PAYLOAD-REBIND-v1";
+var PAYLOAD_DIGEST_PREFIX = "sha256:";
+var PAYLOAD_DIGEST_HEADER = "x-magp-payload-digest";
+var MAX_CANONICAL_PAYLOAD_BYTES = 256 * 1024;
+var MAX_DEPTH = 32;
+var PayloadNotCanonicalizable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PayloadNotCanonicalizable";
+  }
+};
+function hasLoneSurrogate(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c >= 55296 && c <= 56319) {
+      const next = s.charCodeAt(i + 1);
+      if (!(next >= 56320 && next <= 57343)) return true;
+      i++;
+    } else if (c >= 56320 && c <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+function serialize(value, depth, path) {
+  if (depth > MAX_DEPTH) throw new PayloadNotCanonicalizable(`payload is nested deeper than ${MAX_DEPTH} levels at ${path}`);
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number":
+      if (!Number.isFinite(value)) throw new PayloadNotCanonicalizable(`${path} is not a finite number`);
+      return JSON.stringify(value);
+    // ECMAScript Number::toString — what RFC 8785 specifies; -0 serialises as "0"
+    case "string":
+      if (hasLoneSurrogate(value)) throw new PayloadNotCanonicalizable(`${path} contains an unpaired surrogate`);
+      return JSON.stringify(value);
+    case "object": {
+      if (Array.isArray(value)) return `[${value.map((v, i) => serialize(v, depth + 1, `${path}[${i}]`)).join(",")}]`;
+      const proto = Object.getPrototypeOf(value);
+      if (proto !== Object.prototype && proto !== null) throw new PayloadNotCanonicalizable(`${path} is not a plain JSON object`);
+      const obj = value;
+      const keys = Object.keys(obj).sort();
+      const parts = keys.map((k) => {
+        if (hasLoneSurrogate(k)) throw new PayloadNotCanonicalizable(`${path} has a key with an unpaired surrogate`);
+        return `${JSON.stringify(k)}:${serialize(obj[k], depth + 1, `${path}.${k}`)}`;
+      });
+      return `{${parts.join(",")}}`;
+    }
+    default:
+      throw new PayloadNotCanonicalizable(`${path} is a ${typeof value}, which JSON cannot represent`);
+  }
+}
+function canonicalPayload(value) {
+  const text = serialize(value, 0, "$");
+  if (Buffer.byteLength(text, "utf8") > MAX_CANONICAL_PAYLOAD_BYTES) {
+    throw new PayloadNotCanonicalizable(`canonical payload exceeds ${MAX_CANONICAL_PAYLOAD_BYTES} bytes`);
+  }
+  return text;
+}
+function payloadDigestOf(value) {
+  return PAYLOAD_DIGEST_PREFIX + createHash("sha256").update(canonicalPayload(value), "utf8").digest("hex");
+}
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+function isPayloadDigest(value) {
+  return typeof value === "string" && DIGEST_RE.test(value);
+}
+function toWireJson(value) {
+  const text = JSON.stringify(value);
+  if (text === void 0) throw new PayloadNotCanonicalizable("payload is not JSON-serialisable");
+  return JSON.parse(text);
+}
+function buildPayloadBindingMessage(input) {
+  return [PAYLOAD_BINDING_PREFIX, input.agentDid, input.action, input.nonce, input.issuedAt, input.payloadDigest].map((f) => escapeField(String(f))).join("|");
+}
+function buildPayloadRebindMessage(input) {
+  return [PAYLOAD_REBIND_PREFIX, input.agentDid, input.action, input.authorizationId, input.nonce, input.issuedAt, input.payloadDigest].map((f) => escapeField(String(f))).join("|");
+}
+function decideClaimPayload(stored, presented) {
+  if (stored) {
+    if (!presented) return { ok: false, reasonCode: "PAYLOAD_DIGEST_REQUIRED" };
+    return presented === stored ? { ok: true } : { ok: false, reasonCode: "PAYLOAD_DIGEST_MISMATCH" };
+  }
+  return presented ? { ok: false, reasonCode: "PAYLOAD_NOT_BOUND_AT_AUTHORIZE" } : { ok: true };
+}
+function claimDigestField(payloadDigest) {
+  return `payload=${payloadDigest}`;
+}
+function claimEvidenceRefs(idempotencyRef, payloadDigest) {
+  const refs = [...idempotencyRef ? [idempotencyRef] : [], ...payloadDigest ? [`payload:${payloadDigest}`] : []];
+  return refs.length ? refs : null;
+}
+export {
+  MAX_CANONICAL_PAYLOAD_BYTES,
+  PAYLOAD_BINDING_PREFIX,
+  PAYLOAD_DIGEST_HEADER,
+  PAYLOAD_DIGEST_PREFIX,
+  PAYLOAD_REBIND_PREFIX,
+  PayloadNotCanonicalizable,
+  buildPayloadBindingMessage,
+  buildPayloadRebindMessage,
+  canonicalPayload,
+  claimDigestField,
+  claimEvidenceRefs,
+  decideClaimPayload,
+  isPayloadDigest,
+  payloadDigestOf,
+  toWireJson
+};

package/policy-core.mjs

@@ -43,6 +43,15 @@ function riskFloorFor(mandate, target) {
   }
   return floor;
 }
+function requiresPayloadBindingFor(mandate, target) {
+  if (!mandate) return false;
+  for (const p of mandate.permission ?? []) {
+    if (!p || typeof p !== "object") continue;
+    if ((p.target ?? mandate.target) !== target) continue;
+    if (p.requirePayloadBinding === true) return true;
+  }
+  return false;
+}
 var FIELD_KINDS = {
   riskLevel: "risk",
   consent: "boolean",
@@ -634,16 +643,24 @@ function evaluateMandate(mandate, req) {
     };
   }
   for (const p of perms) {
-    const failing = (p.constraint ?? []).find((c) => !constraintSatisfied(c, req, true));
-    if (!failing) return { decision: "allow", reasonCode: "AUTHORIZED" };
+    const failing2 = (p.constraint ?? []).find((c) => !constraintSatisfied(c, req, true));
+    if (!failing2) return { decision: "allow", reasonCode: "AUTHORIZED" };
   }
-  const firstFail = (perms[0].constraint ?? []).find((c) => !constraintSatisfied(c, req, true));
+  const failing = (perms[0].constraint ?? []).filter((c) => !constraintSatisfied(c, req, true));
+  const firstFail = failing[0];
+  const reported = reportedFailure(failing) ?? firstFail;
   return {
     decision: firstFail?.onFail ?? "block",
-    reasonCode: reasonFor(firstFail, req),
-    matched: { kind: "permission", target: perms[0].target, constraint: firstFail }
+    reasonCode: reasonFor(reported, req),
+    matched: { kind: "permission", target: perms[0].target, constraint: reported }
   };
 }
+function reportedFailure(failing) {
+  const first = failing[0];
+  if (!first || !AMOUNT_OPERANDS.has(first.leftOperand)) return void 0;
+  const decision = first.onFail ?? "block";
+  return failing.find((c) => !AMOUNT_OPERANDS.has(c.leftOperand) && (c.onFail ?? "block") === decision);
+}
 function remainingBudget(b) {
   return Math.max(0, b.cap - b.spent - b.held);
 }
@@ -791,6 +808,7 @@ export {
   remainingBudget,
   requiredContextFor,
   requiredContextOf,
+  requiresPayloadBindingFor,
   riskFloorFor,
   sumEventField,
   validateMolecules

package/service-installer.mjs

@@ -26,6 +26,13 @@ function defaultNodePath() {
   return process.execPath || '/usr/bin/node';
 }
 
+/** One ExecStart= word. systemd splits the line on whitespace, so a path with a space in it (a node under
+ *  `/opt/Node JS/`, or `C:\Program Files\nodejs\node.exe` when the unit is generated on Windows) became two words and
+ *  the unit failed at exec. Double quotes are systemd's own quoting, with `\` and `"` escaped inside them. */
+function systemdArg(value) {
+  return /\s/.test(value) ? `"${value.replace(/(["\\])/g, '\\$1')}"` : value;
+}
+
 function assertTier(tier) {
   if (tier !== 1 && tier !== 2) throw new Error(`tier must be 1 or 2, got ${tier}`);
 }
@@ -74,7 +81,7 @@ export function generateSystemdUnits({ identity, tier, nodePath = defaultNodePat
   const cliInvocationPath = tier === 1 && !isAbsolutePath ? `%h/${resolvedCliPath.replace(/^\.?\//, '')}` : resolvedCliPath;
   // %S is systemd's own state-directory root, so this lines up with StateDirectory= below rather
   // than hard-coding a path that has to be kept in sync with it by hand.
-  const invocation = `${nodePath} ${cliInvocationPath} start --state-dir %S/agentsafe/%i --role ${role} --identity %i`;
+  const invocation = `${systemdArg(nodePath)} ${systemdArg(cliInvocationPath)} start --state-dir %S/agentsafe/%i --role ${role} --identity %i`;
   // No setpriv wrapper. An earlier pass wrapped this in `setpriv --dumpable 0 --` to deny ptrace
   // via PR_SET_DUMPABLE=0. That option does not exist: util-linux's setpriv has no --dumpable flag
   // (checked on util-linux 2.39.3 / Ubuntu 24.04 LTS — the string is absent from the binary